GHSA-428g-f7cq-pgp5
Marshmallow has DoS in Schema.load(many)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | marshmallow | >= 3.0.0rc1, < 3.26.2 | 3.26.2 |
| PyPI | marshmallow | >= 4.0.0, < 4.1.2 | 4.1.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.
### Patches
4.1.2, 3.26.2
### Workarounds
```py
# Fail fast
def load_many(schema, data, **kwargs):
if not isinstance(data, list):
raise ValidationError(['Invalid input type.'])
return [schema.load(item, **kwargs) for item in data]
```
References
External links from the advisory. They lead to third-party sites.